PRIVACY > 


NOTICE T 


We care about your privacy 


Viaplay Group (‘we’, and/or ‘us’, and/or ‘our’) is committed to protecting your 
privacy and personal data. This Privacy Notice is intended to help you understand 
what data we collect, why we collect it, and what we do with it when you attend 
and participate in our annual general meeting (AGM) as a shareholder or any other 
individual. 


You will also find information about your personal data rights under the General 
Data Protection Regulation (GDPR) and any supplementary data protection 
regulations. 


Let’s start with some definitions 


Personal data means any information or combination of information that, directly 
or indirectly, identifies you. 


Processing means any action taken in relation to personal data, including 
collection, use, disclosure, retention, deletion. 


Data controller is the party responsible for deciding what personal data is 
collected about you and how it is processed. 


Responsibility for the use of your personal data 


Viaplay Group AB (registration number 559124-6847, Box 17104, 104 62 
Stockholm, Sweden) is responsible data controller for the use of your personal 
data as described in this Privacy Notice, unless otherwise stated. You are welcome 
to address any questions regarding this Privacy Notice to dpo@viaplaygroup.com. 


We have appointed Euroclear Sweden AB (registration number 556112-8074, 
Klarabergsviadukten 63, 101 23 Stockholm, Sweden) to facilitate our AGMs and 
provide related services. As a result, when you provide personal data to Euroclear 
Sweden AB, they are responsible for processing it as a separate data controller. 
For any questions about that processing of your data, please reach out to 


es.dpo@euroclear.com. 
Information we collect about you 


We collect and use different categories of personal data about you, depending on 
your role and how you participate in our AGM. 


The categories of personal data that we collect, and use, include: 
e Identification information (full name, personal identification number). 
e Contact information (address, telephone number, e-mail address). 


e Financial information (voting rights, information regarding holdings and 
entitlements connected to the holdings). 


e Representation information (proxy's identification information, assistant’s 
information, company you're representing). 


e Voting information (information on how you have voted, e.g., in case of 
postal voting, if voting devices are used, vote counting is carried out as well 
as through publication of the vote results). 


e Communication information (dissenting opinions as part of the notes in the 
minutes from the AGM, or when exercising the right as shareholder to 
propose business at the AGM, make statements or ask questions). 


Where we collect your data from 


We collect your personal data mainly directly from you, e.g., when you send us 
personal data via forms, e-forms, e-mails, telephone or during the AGM either at 
the meeting venue or remotely by participating online. 


We may also receive your personal data through information received from public 
records, information received from the central securities depository (Euroclear 
Sweden AB) or other third-party service providers in connection with the AGM 
(such as legal advisors), or the shareholder you represent or your proxy (if 
relevant). 


Purposes for collecting and using your data 


We use the information we collect for several purposes, and the same categories 
of data may be used differently for different purpose. These purposes, the legal 
basis for use, and the length of time we keep your personal data are all explained 
below. 


Purpose Categories of personal data 


Identification information, financial 
information, representation information, 
voting information. 


Legal basis 


Legal obligation - Article 6.1(c) GDPR For as long as necessary to meet our legal 
obligations under applicable laws but not 
longer than 10 years after the AGM. 


Carry out and manage our annual general 
meetings. 


The use of your personal data is necessary 
to comply with our legal obligation under 
applicable laws. 


Purpose Categories of personal data 


Handle communication initiated by Identification information, contact 
shareholders or a contact person. information, communication information. 


Legal basis 


Legitimate interests - Article 6.1(f) GDPR | Personal data is stored for this purpose 


The use of your personal data is necessary 
to satisfy our legitimate interest of 
responding to questions that you have. 
We believe that our legitimate interest 
outweighs your interest in not having your 
personal data processed for this purpose, 
especially since you have contacted us. 


for a period of eighteen (18) months 
calculated from the date of the last 
communication in the same matter. 


Sharing of your personal data 


Your personal data is primarily processed by us as the data controller. In certain 
cases, we may transfer your personal data to: 


Affiliated entities or business partners to the extent necessary in 
connection with the AGM. We take precautions to allow access to 
personal data only to those staff members who have a legitimate 
business need for access and with a contractual prohibition of using 
the personal data for any other purpose. 


Competent law enforcement body, regulatory, government agency, 
court or other third party such as but not limited to, the police, the 
financial supervisory authorities, the tax agency, or the Swedish 
companies’ registration office, where we believe disclosure is 
necessary (i) as a matter of applicable law or regulation, or (ii) to 
exercise, establish or defend our legal rights. 


Third-party vendors, service providers and partners who provide 
services to us (e.g., third party consultants working with the AGM, law 
firms/advisors, security agents or providers of services to conduct the 
AGM digitally if such services are used at the meeting), which are or 
will be involved in providing services in connection with the AGM or 
who otherwise process personal data for purposes that are described 
in this privacy notice or as notified to you when we collect your 
personal data. 


Our auditors, advisors, legal representatives, and similar agents as 
may be necessary in connection with the advisory services they 
provide to us for legitimate business purposes and under contractual 
prohibition of using the personal data for any other purpose. 


e Other recipients, such as participants in the AGM if they request the 
list of notices of attendance (which contains names of shareholders 
together with information regarding their number of shares and 
votes, and information on their respective proxy and/or assistant(s), 
if any) as the basis for determining the voting list at the AGM. We 
may also disclose personal data to other shareholders who request a 
copy of the minutes from the AGM. 


Where we process your personal data 


We generally process and store your data within the European Economic Area 
(EEA). Because our Group companies and third-party contractors and consultants 
operate both within and outside the EEA, your personal data may be occasionally 
processed outside the EEA. However, we have taken appropriate safeguards to 
require that your personal data remains protected in accordance with this Privacy 
Notice. These measures include, where applicable, implementing EU standard 
contractual clauses with our third-party contractors. 


A uniform level of data protection is ensured by means of internal data protection 
regulations and/or corresponding contractual agreements. 


Your data protection rights 
You have the following data protection rights, under certain conditions: 


e access and obtain a copy of your personal data, 

e rectify/change incorrect or incomplete personal data, 
e delete/erase your personal data, 

e restrict the processing of your personal data, 

e request your personal data in a portable format, 

e object to the processing of your personal data. 


If you would like to exercise any of your rights, please contact our DPO at 
dpo@viaplaygroup.com. We normally respond to your request within one month 
following the date we received your request. If your request is complicated, or if 
you have submitted several requests, we may need additional time to handle your 
request. In any case, you will be notified for the reasons of the delay within one 
month following the date we received your request. 


If you believe that Viaplay Group has not complied with your data protection 
rights, you can contact the supervisory authority in the country where you feel 
most secure, or you can contact the Swedish Data Protection Authority 
(Integritetsskyddsmyndigheten) at imy@imy.se or call at 08-657 61 00. 


Updates to this Privacy Notice 


We regularly update this Privacy Notice. Our use of personal data may change, for 
example we may collect personal data for new purposes, collect additional 


categories of personal data or share your data with other recipients than outlined 
in this Privacy Notice. 


We reserve the right to change this Privacy Notice at any time. This Privacy Notice 
is effective from April 25, 2023. 


Contact us 


Questions, comments, and requests regarding this Privacy Notice should be 
addressed to our DPO at dpo@viaplaygroup.com or in writing to Viaplay Group 
AB, Box 17104, 104 62 Stockholm, Sweden. 


